Frun1na opened a new issue, #6091: URL: https://github.com/apache/rocketmq-dashboard/issues/6091
### Before Creating the Bug Report - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate. - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository. - [x] I can reproduce this on the current `rocketmq-studio` branch, or I have stated the exact version I am running below. ### Studio Version branch: `rocketmq-studio` git commit id: `5e4c39b0` deployed as: reproduced by unit tests against that commit (the affected code is the backend persistence and ACL layer) ### Runtime Environment OS: Ubuntu on WSL2 MySQL: not applicable — the defect is the generated `toString()` of four types, reproduced in a JUnit 5 test browser: not applicable ### Connected RocketMQ Cluster RocketMQ version: not applicable — no cluster participates; the values come from Studio's own storage and API models access mode: not applicable deployment: not applicable ### Describe the Bug A Lombok `@Data` class generates a `toString()` that prints every field. For the credential-bearing types Studio stores, that means the secret column is part of the representation, so any `log.info("... {}", object)`, exception message or diagnostic dump that renders one of them writes the credential to disk in clear text. The repository already excludes the secret fields of the other credential types — `RmqSettings` (LLM API key), `RmqStudioUser` (password hash), `RmqK8sCertificate` and `K8sCertVO` (private key), `CreateCloudCredentialDTO`, `UpsertPlainAccessConfigDTO`, `DataSourceTestDTO`, `MetricsDataSourceQueryRequest`, `GeneralSettingsVO`, `GeneralSettingsUpdateDTO`, `LoginDTO` and `ResetPasswordDTO`. Four types that carry the same material were left out, and the note on the k8s redaction fix (#4555) names them explicitly as a follow-up: - `persistence/entity/RmqCloudCredential.java` — `accessKey` / `secretKey` (the stored cloud credential). - `persistence/entity/RmqAclUser.java` — `accessKey` / `secretKey` of an ACL user. - `persistence/entity/RmqDataSource.java` — `json`, the serialized `MetricsDataSourceConfig` whose `password` / `bearerToken` fields are marked sensitive in that model's own javadoc. - `instance/acl/PlainAccessConfigVO.java` — `accessKey` / `secretKey`; the write endpoint echoes the plaintext secret back in this object, and its request DTO (`UpsertPlainAccessConfigDTO`) already redacts both fields. ### Steps to Reproduce 1. Build any of the four objects with a secret and render it, e.g. `log.info("acl user {}", aclUser)` or an assertion failure that prints the object. 2. Or run the regression test: ``` cd server && mvn -B -ntp test -Dtest=CredentialToStringRedactionTest ``` ### What Did You Expect to See? The representation names the object's identity (`name`, `username`, `dsKey`, the address whitelist) and omits the credential, the same way the twelve types listed above behave. ### What Did You See Instead? `RmqCloudCredential`, `RmqAclUser`, `RmqDataSource` and `PlainAccessConfigVO` print the access key, the secret key and the serialized data-source configuration in full. ### Additional Context The same fix was accepted twice already for the same reason: #4555 (certificate private keys) and #4472 (`LlmProperties` provider token). A fix with a regression test follows in a pull request. ### Are You Willing to Submit a Pull Request? - [x] Yes, I am willing to submit a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
